T08 · Insecure Dependencies
Warning
- Location
package.json:9- Finding
Unpinned Dependencies and Unnecessary Runtime Package Increase Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Security audit
Instant DB
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a real InstantDB admin helper, but it gives an agent live database read/write/delete power with an admin token and too little safety scoping.
Install only if you intend to give the agent admin-level access to the specified InstantDB app. Use a dedicated token if possible, keep it out of prompts/logs/client code, prefer staging or backups before write/delete operations, and require explicit user confirmation for deletes, unlinking, cascade deletes, and bulk transactions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The cascade delete pattern demonstrates multi-record destruction without any safeguard, warning, or recommendation to verify scope before execution. In an admin-oriented real-time database skill, this is more dangerous because an agent or developer may copy the pattern directly and accidentally delete a primary record plus related records at scale, causing irreversible data loss.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger text is broad enough to activate on generic mentions of real-time updates, database sync, entity operations, or human-visible status updates, which can cause this admin-capable skill to be selected in contexts where the user did not explicitly intend InstantDB administration. Because the skill supports destructive and privileged actions, unintended invocation materially increases the risk of unauthorized data access or modification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README prominently advertises create, update, delete, link, unlink, and transact admin operations but does not warn that these actions can irreversibly modify production data. In an agent setting, missing safety guidance around destructive capabilities makes accidental or overbroad data mutation more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The setup instructs users to export an admin token and the skill enables querying and subscribing to real-time data, but the documentation provides no warning about the sensitivity of admin credentials or the privacy implications of broad data access. In an agent workflow, this can encourage unsafe handling of high-privilege secrets and overexposure of live application data.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill documents use of environment variables, including an admin token, but does not declare an explicit tool scope or permissions boundary. In an agent setting, missing scope metadata can cause the skill to be invoked without clear guardrails around credential access, increasing the chance of unintended secret use or over-privileged execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger text is very broad, covering generic database, sync, and real-time update scenarios rather than narrowly scoped invocation conditions. In an autonomous agent workflow, this can cause the skill to activate in unrelated contexts and perform sensitive admin-capable actions when a safer or read-only skill would have been more appropriate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The setup instructions tell users to export
INSTANTDB_ADMIN_TOKENbut do not warn that it is a highly sensitive administrative credential with broad write/delete privileges. In this skill's context, that omission is especially risky because the same document immediately teaches powerful admin operations, making accidental leakage, misuse, or overbroad deployment of the token more likely.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill provides examples for delete, unlink, and transaction-based bulk mutation operations without any warning, approval step, or safety guidance around irreversible data changes. Because this skill is specifically for InstantDB admin operations, the context makes the omission more dangerous: an agent could directly modify or remove production data and relationships at scale with little friction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file includes a delete transaction example, but the surrounding documentation provides no warning that the operation removes data. For markdown files, safety-affecting behaviors that can impact user data should be disclosed so users understand the risk before copying the pattern.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "test": "echo \"Error: no test specified\" && exit 1" }, "dependencies": { "@instantdb/admin": "^0.14.0", "ws": "^8.18.0" }, "engines": {
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json }, "dependencies": { "@instantdb/admin": "^0.14.0", "ws": "^8.18.0" }, "engines": { "node": ">=18.0.0"
Unverifiable Dependency: ws has 7 known advisory(ies) (CVE-2016-10518 (Remote Memory Disclosure in ws); CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
The manifest declares ws with a non-exact version despite known advisories affecting some ws releases, so consumers cannot verify from this file alone whether the resolved package is patched. In the context of an InstantDB real-time integration, WebSocket handling is likely exposed to untrusted network input, making denial-of-service or memory-disclosure issues more relevant than in a purely local tool.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest describes InstantDB admin operations and real-time subscriptions, but does not mention credential discovery or secret handling. This script directly reads privileged admin credentials from process environment variables, which is an additional capability beyond the core CRUD/subscription behavior.
- Content
Static analysis
No suspicious patterns detected.